Security Disclosures

Threats caught in the agent economy: x402 endpoints with on-chain proof, and MCP packages that changed after adoption · by PulseFeed · Drift Watch · Changes · Observatory

337
high severity
242
medium
0
receiver hijacks
0
bait-and-switch
579
total active

Active incidents

🕳
Repository link removed — the source can no longer be reviewed. Versions: 0.1.1 → 0.1.6. Recorded by PulseFeed's daily watch of the official MCP registry — the previous snapshot is what makes this a change rather than a state.
8h ago
🕳
Repository link removed — the source can no longer be reviewed. Versions: 0.1.7 → 0.6.59. Recorded by PulseFeed's daily watch of the official MCP registry — the previous snapshot is what makes this a change rather than a state.
8h ago
🎭
@hubspot/mcp-server mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @hubspot/mcp-server maintainer_changed
8h ago
🎭
@payloadcms/plugin-mcp mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @payloadcms/plugin-mcp maintainer_changed
8h ago
🕳
formlab-mcp mcp repo removed
Repository link removed — the source can no longer be reviewed. Versions: 0.6.56 → 0.6.59. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ formlab-mcp repo_removed
8h ago
🕳
tools.engram/engram mcp repo removed
Repository link removed — the source can no longer be reviewed. Versions: 0.4.4 → 0.4.6. Recorded by PulseFeed's daily watch of the official MCP registry — the previous snapshot is what makes this a change rather than a state.
2d ago
💨
No longer listed in the official MCP registry. Recorded by PulseFeed's daily watch of the official MCP registry — the previous snapshot is what makes this a change rather than a state.
2d ago
💨
com.golproductions/envie mcp unpublished
No longer listed in the official MCP registry. Recorded by PulseFeed's daily watch of the official MCP registry — the previous snapshot is what makes this a change rather than a state.
2d ago
💨
com.golproductions/exnos mcp unpublished
No longer listed in the official MCP registry. Recorded by PulseFeed's daily watch of the official MCP registry — the previous snapshot is what makes this a change rather than a state.
2d ago
🕳
Repository link removed — the source can no longer be reviewed. Versions: 2.5.9 → 2.6.0. Recorded by PulseFeed's daily watch of the official MCP registry — the previous snapshot is what makes this a change rather than a state.
3d ago
💨
No longer listed in the official MCP registry. Recorded by PulseFeed's daily watch of the official MCP registry — the previous snapshot is what makes this a change rather than a state.
3d ago
💨
No longer listed in the official MCP registry. Recorded by PulseFeed's daily watch of the official MCP registry — the previous snapshot is what makes this a change rather than a state.
3d ago
💨
No longer listed in the official MCP registry. Recorded by PulseFeed's daily watch of the official MCP registry — the previous snapshot is what makes this a change rather than a state.
3d ago
🎭
@powerhousedao/reactor-mcp mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @powerhousedao/reactor-mcp maintainer_changed
3d ago
🕳
sh.fettle/mcp mcp repo removed
Repository link removed — the source can no longer be reviewed. Versions: 0.1.1 → 0.2.0. Recorded by PulseFeed's daily watch of the official MCP registry — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ sh.fettle/mcp repo_removed
4d ago
🎭
@storybook/addon-mcp mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 2,404,352 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @storybook/addon-mcp maintainer_changed
4d ago
🎭
@storybook/mcp mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 2,198,102 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @storybook/mcp maintainer_changed
4d ago
🎭
@payloadcms/plugin-mcp mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 130,816 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @payloadcms/plugin-mcp maintainer_changed
4d ago
🕳
@dfm-fi/agent mcp repo removed
Repository link removed — the source can no longer be reviewed. Versions: 0.2.1812 → 0.2.1856. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @dfm-fi/agent repo_removed
4d ago
💨
No longer listed in the official MCP registry. Recorded by PulseFeed's daily watch of the official MCP registry — the previous snapshot is what makes this a change rather than a state.
5d ago
🎭
@hubspot/mcp-server mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 25,027 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @hubspot/mcp-server maintainer_changed
5d ago
💨
com.graneth/mcp-server mcp unpublished
No longer listed in the official MCP registry. Recorded by PulseFeed's daily watch of the official MCP registry — the previous snapshot is what makes this a change rather than a state.
5d ago
💨
No longer listed in the official MCP registry. Recorded by PulseFeed's daily watch of the official MCP registry — the previous snapshot is what makes this a change rather than a state.
5d ago
🎭
@wonderwhy-er/desktop-commander mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 348,832 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
6d ago
🎭
@heroku/mcp-server mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 10,678 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @heroku/mcp-server maintainer_changed
6d ago
🎭
@chkp/mcp-utils mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 2,101 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @chkp/mcp-utils maintainer_changed
6d ago
🎭
@assistant-ui/mcp-docs-server mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Versions: 0.3.2 → 0.3.3. The package is installed about 904 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
6d ago
🎭
@assistant-ui/react mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Versions: 0.15.23 → 0.15.25. The package is installed about 2,367,302 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @assistant-ui/react maintainer_changed
7d ago
🎭
@assistant-ui/react-mcp mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Versions: 0.1.20 → 0.1.21. The package is installed about 6,236 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @assistant-ui/react-mcp maintainer_changed
7d ago
💨
No longer listed in the official MCP registry. Recorded by PulseFeed's daily watch of the official MCP registry — the previous snapshot is what makes this a change rather than a state.
8d ago
🎭
@nitrostack/cli mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @nitrostack/cli maintainer_changed
8d ago
🎭
@nitrostack/widgets mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 21,713 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @nitrostack/widgets maintainer_changed
8d ago
🎭
@nitrostack/core mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 18,345 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @nitrostack/core maintainer_changed
8d ago
🎭
@runpod/mcp-server mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @runpod/mcp-server maintainer_changed
8d ago
🎭
@paypal/mcp mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 995 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @paypal/mcp maintainer_changed
8d ago
🕳
Repository link removed — the source can no longer be reviewed. Versions: 0.2.2 → 0.2.3. Recorded by PulseFeed's daily watch of the official MCP registry — the previous snapshot is what makes this a change rather than a state.
9d ago
🕳
Repository link removed — the source can no longer be reviewed. Versions: 0.6.5 → 0.6.6. Recorded by PulseFeed's daily watch of the official MCP registry — the previous snapshot is what makes this a change rather than a state.
9d ago
💨
No longer listed in the official MCP registry. Recorded by PulseFeed's daily watch of the official MCP registry — the previous snapshot is what makes this a change rather than a state.
9d ago
🕳
openfactor mcp repo removed
Repository link removed — the source can no longer be reviewed. Versions: 0.3.0-1791076906.gf1585f7ab7b7 → 0.3.0-1791162210.ge1b2611cb328. The package is installed about 36,395 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ openfactor repo_removed
9d ago
🕳
@nexrall/code-core mcp repo removed
Repository link removed — the source can no longer be reviewed. Versions: 1.4.57 → 1.4.77. The package is installed about 2,255 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @nexrall/code-core repo_removed
9d ago
☠️
loki-mode mcp install script added
Install script added: arbitrary code now runs on `npm i` — it was not there in 10.6.7. Versions: 10.6.7 → 10.11.0. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ loki-mode install_script_added
10d ago
☠️
@atheory-ai/skillex mcp install script added
Install script added: arbitrary code now runs on `npm i` — it was not there in 0.9.1. Versions: 0.9.1 → 0.10.0. The package is installed about 6,590 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @atheory-ai/skillex install_script_added
10d ago
🎭
@opencx/mcp mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Versions: 1.15.56 → 1.15.58. The package is installed about 2,296 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @opencx/mcp maintainer_changed
10d ago
🎭
aleph-siliconflow-mcp mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ aleph-siliconflow-mcp maintainer_changed
10d ago
🎭
@runpod/mcp-server mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 11,254 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @runpod/mcp-server maintainer_changed
11d ago
🎭
@heroku/mcp-server mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @heroku/mcp-server maintainer_changed
11d ago
🕳
Repository link removed — the source can no longer be reviewed. Versions: 0.1.3 → 0.7.1. Recorded by PulseFeed's daily watch of the official MCP registry — the previous snapshot is what makes this a change rather than a state.
12d ago
💨
No longer listed in the official MCP registry. Recorded by PulseFeed's daily watch of the official MCP registry — the previous snapshot is what makes this a change rather than a state.
12d ago
💨
No longer listed in the official MCP registry. Recorded by PulseFeed's daily watch of the official MCP registry — the previous snapshot is what makes this a change rather than a state.
12d ago
🎭
@storybook/mcp mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 2,779,433 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @storybook/mcp maintainer_changed
12d ago
🎭
@storybook/addon-mcp mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 2,835,581 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @storybook/addon-mcp maintainer_changed
12d ago
🕳
@noodleseed/one mcp repo removed
Repository link removed — the source can no longer be reviewed. Versions: 0.193.1 → 0.196.0. The package is installed about 4,538 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @noodleseed/one repo_removed
12d ago
🕳
@optimus-ai/mcp mcp repo removed
Repository link removed — the source can no longer be reviewed. Versions: 1.1.5 → 1.1.17. The package is installed about 3,401 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @optimus-ai/mcp repo_removed
12d ago
🕳
@noodleseed/agent-kit mcp repo removed
Repository link removed — the source can no longer be reviewed. Versions: 0.114.1 → 0.117.0. The package is installed about 1,499 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
12d ago
🎭
@minecraft/creator-tools mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @minecraft/creator-tools maintainer_changed
13d ago
🎭
@jelou/cli mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Versions: 3.2.1 → 3.6.0. The package is installed about 3,276 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @jelou/cli maintainer_changed
13d ago
🎭
@oomol-lab/open-connector mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Versions: 1.7.0 → 1.8.0. The package is installed about 4,674 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @oomol-lab/open-connector maintainer_changed
13d ago
🎭
@adobe/design-data-mcp mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Versions: 1.8.3 → 1.8.4. The package is installed about 845 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @adobe/design-data-mcp maintainer_changed
13d ago
🎭
@adobe/design-data-agent-mcp mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Versions: 1.13.0 → 1.14.0. The package is installed about 922 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
13d ago
🎭
@covalenthq/goldrush-mcp-server mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Versions: 3.0.6 → 3.0.7. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
13d ago
🎭
@adobe/spectrum-design-data-mcp mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Versions: 1.1.77 → 1.1.78. The package is installed about 552 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
13d ago
🎭
@heroku/mcp-server mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @heroku/mcp-server maintainer_changed
14d ago
🎭
agentmail-mcp mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 2,860 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ agentmail-mcp maintainer_changed
14d ago
🎭
upload-post mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ upload-post maintainer_changed
14d ago
☠️
@zerwiz/ymir mcp install script added
Install script added: arbitrary code now runs on `npm i` — it was not there in 0.1.52. Versions: 0.1.52 → 0.1.53. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @zerwiz/ymir install_script_added
14d ago
🎭
@ibm/ibmi-mcp-server mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 837 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @ibm/ibmi-mcp-server maintainer_changed
14d ago
🎭
gitnexus mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ gitnexus maintainer_changed
15d ago
🎭
@heroku/mcp-server mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @heroku/mcp-server maintainer_changed
15d ago
🎭
@nexus2520/bitbucket-mcp-server mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Versions: 3.0.0 → 3.0.1. The package is installed about 8,067 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
17d ago
🎭
@nexus2520/jira-mcp-server mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @nexus2520/jira-mcp-server maintainer_changed
17d ago
🎭
configure mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ configure maintainer_changed
17d ago
🕳
com.htmlradar/share mcp repo removed
Repository link removed — the source can no longer be reviewed. Versions: 0.4.0 → 0.5.1. Recorded by PulseFeed's daily watch of the official MCP registry — the previous snapshot is what makes this a change rather than a state.
18d ago
☠️
@luckydraw/cumulus mcp install script added
Install script added: arbitrary code now runs on `npm i` — it was not there in 1.0.64. Versions: 1.0.64 → 1.0.66. The package is installed about 1,384 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @luckydraw/cumulus install_script_added
18d ago
🕳
Repository link removed — the source can no longer be reviewed. Versions: 2.17.0 → 3.0.0. Recorded by PulseFeed's daily watch of the official MCP registry — the previous snapshot is what makes this a change rather than a state.
19d ago
🎭
@heroku/mcp-server mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Versions: 1.2.8 → 1.2.9. The package is installed about 6,309 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @heroku/mcp-server maintainer_changed
19d ago
☠️
@aiwayds/dsh-mcp-adapter mcp install script added
Install script added: arbitrary code now runs on `npm i` — it was not there in 0.4.2. Versions: 0.4.2 → 0.5.1. The package is installed about 255 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @aiwayds/dsh-mcp-adapter install_script_added
19d ago
💨
com.getskarn/skarn mcp unpublished
No longer listed in the official MCP registry. Recorded by PulseFeed's daily watch of the official MCP registry — the previous snapshot is what makes this a change rather than a state.
20d ago
💨
com.iwantmyname/mcp mcp unpublished
No longer listed in the official MCP registry. Recorded by PulseFeed's daily watch of the official MCP registry — the previous snapshot is what makes this a change rather than a state.
20d ago
🎭
@runpod/mcp-server mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 6,450 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @runpod/mcp-server maintainer_changed
20d ago
🎭
@seed-design/docs-mcp mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 986 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @seed-design/docs-mcp maintainer_changed
20d ago
☠️
troxy-cli mcp install script added
Install script added: arbitrary code now runs on `npm i` — it was not there in 1.29.17. Versions: 1.29.17 → 1.29.19. The package is installed about 760 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ troxy-cli install_script_added
20d ago
🎭
fnf-after-effects-mcp mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Versions: 0.1.1 → 0.1.3. The package is installed about 2,219 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ fnf-after-effects-mcp maintainer_changed
20d ago
🕳
fnf-after-effects-mcp mcp repo removed
Repository link removed — the source can no longer be reviewed. Versions: 0.1.1 → 0.1.3. The package is installed about 2,219 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
20d ago
🕳
@carrierllc/mcp mcp repo removed
Repository link removed — the source can no longer be reviewed. Versions: 0.13.0 → 0.13.7. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @carrierllc/mcp repo_removed
20d ago
🎭
vision-relay mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Versions: 0.12.16 → 0.13.0. The package is installed about 104 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ vision-relay maintainer_changed
20d ago
🕳
io.github.Rswcf/deepviews mcp repo removed
Repository link removed — the source can no longer be reviewed. Versions: 1.0.1 → 1.1.1. Recorded by PulseFeed's daily watch of the official MCP registry — the previous snapshot is what makes this a change rather than a state.
21d ago
🕳
Repository link removed — the source can no longer be reviewed. Versions: 0.4.2 → 0.4.5. Recorded by PulseFeed's daily watch of the official MCP registry — the previous snapshot is what makes this a change rather than a state.
21d ago
💨
No longer listed in the official MCP registry. Recorded by PulseFeed's daily watch of the official MCP registry — the previous snapshot is what makes this a change rather than a state.
21d ago
💨
No longer listed in the official MCP registry. Recorded by PulseFeed's daily watch of the official MCP registry — the previous snapshot is what makes this a change rather than a state.
21d ago
🎭
decocms mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Versions: 4.388.1 → 4.390.8. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ decocms maintainer_changed
21d ago
🎭
@imgly/codesign-mcp mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @imgly/codesign-mcp maintainer_changed
21d ago
🎭
agentcat mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ agentcat maintainer_changed
21d ago
🎭
@inkeep/open-knowledge mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Versions: 0.76.1 → 0.77.1. The package is installed about 11,163 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @inkeep/open-knowledge maintainer_changed
22d ago
🎭
@tempoxyz/mercator mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Versions: 0.0.680 → 0.0.703. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @tempoxyz/mercator maintainer_changed
22d ago
🎭
@heroku/mcp-server mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @heroku/mcp-server maintainer_changed
22d ago
🎭
@runpod/mcp-server mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 6,599 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @runpod/mcp-server maintainer_changed
22d ago
🎭
@antv/mcp-server-chart mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @antv/mcp-server-chart maintainer_changed
22d ago
🎭
@ibm/ibmi-mcp-server mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 766 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @ibm/ibmi-mcp-server maintainer_changed
22d ago
🎭
@mintlify/mcp mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 2,084 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @mintlify/mcp maintainer_changed
22d ago
🎭
@polderlabs/bizar mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 869 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @polderlabs/bizar maintainer_changed
22d ago
🎭
@qingflow-tech/qingflow-cli mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Versions: 1.1.47 → 1.1.48. The package is installed about 582 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @qingflow-tech/qingflow-cli maintainer_changed
22d ago
🎭
@eraserlabs/eraser-mcp mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 50 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @eraserlabs/eraser-mcp maintainer_changed
22d ago
🎭
@zenrows/mcp mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Versions: 2.2.0 → 2.2.4. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @zenrows/mcp maintainer_changed
22d ago
💨
com.agishub/mcp mcp unpublished
No longer listed in the official MCP registry. Recorded by PulseFeed's daily watch of the official MCP registry — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ com.agishub/mcp unpublished
23d ago
🎭
@runpod/mcp-server mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 5,824 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @runpod/mcp-server maintainer_changed
23d ago
☠️
@yawlabs/mcp mcp install script added
Install script added: arbitrary code now runs on `npm i` — it was not there in 0.75.2. Versions: 0.75.2 → 1.0.10. The package is installed about 1,020 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @yawlabs/mcp install_script_added
23d ago
🎭
@aifinpay/agent mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Versions: 1.8.4 → 2.1.2. The package is installed about 882 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @aifinpay/agent maintainer_changed
23d ago
🎭
@posthog/mcp mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 205,754 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @posthog/mcp maintainer_changed
25d ago
🎭
@modelcontextprotocol/codemod mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 2,342 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
25d ago
🕳
Repository link removed — the source can no longer be reviewed. Versions: 1.5.0 → 1.7.0. Recorded by PulseFeed's daily watch of the official MCP registry — the previous snapshot is what makes this a change rather than a state.
26d ago
💨
No longer listed in the official MCP registry. Recorded by PulseFeed's daily watch of the official MCP registry — the previous snapshot is what makes this a change rather than a state.
26d ago
💨
No longer listed in the official MCP registry. Recorded by PulseFeed's daily watch of the official MCP registry — the previous snapshot is what makes this a change rather than a state.
26d ago
💨
dev.toolstop/prop65 mcp unpublished
No longer listed in the official MCP registry. Recorded by PulseFeed's daily watch of the official MCP registry — the previous snapshot is what makes this a change rather than a state.
26d ago
🎭
@modelcontextprotocol/sdk mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 50,000,448 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @modelcontextprotocol/sdk maintainer_changed
26d ago
🎭
@modelcontextprotocol/core mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 5,647,596 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @modelcontextprotocol/core maintainer_changed
26d ago
🎭
@modelcontextprotocol/client mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 3,423,399 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
26d ago
🎭
@modelcontextprotocol/server mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 4,894,783 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
26d ago
🎭
@modelcontextprotocol/node mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 1,527,359 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @modelcontextprotocol/node maintainer_changed
26d ago
🎭
@modelcontextprotocol/express mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. The package is installed about 341,058 times a week. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
26d ago
🎭
@modelcontextprotocol/hono mcp ownership changed
Package ownership changed — whoever you trusted is no longer the one publishing it. Recorded by PulseFeed's daily external re-audit — the previous snapshot is what makes this a change rather than a state.
verify on npm ↗ @modelcontextprotocol/hono maintainer_changed
26d ago
Why this matters — ~38% of x402 endpoints are dead or scams, and a safe endpoint can be hijacked or repriced overnight. Every incident above is derived from PulseFeed's continuous independent audit and, where the receiver is on Base, linked to on-chain proof you can verify yourself.

Verify before your agent pays: GET /trust?endpoint=<url> · Machine-readable: /incidents.json · Full dataset: PulseFeed Data API

Honesty note: categories are stated as facts from our data (e.g. "payTo has no on-chain USDC history", "advertised price ≠ amount actually charged"). We do not assert intent where it can't be proven; an "unverified receiver" or "possible hijack" is a risk signal, not a conviction. By-design receiver rotation is excluded. Window: 30 days · 579 active incidents · generated 2026-10-14T10:10:53.244Z.
Observatory · Changes · Methodology · Data API